3
votes
1answer
413 views

Are man-in-the-middle attacks against p2p systems realistic?

I'm implementing a DHT based on Kademlia following this paper. The protocol described in this paper uses nonces to protect against man-in-the-middle attacks. The disadvantage is that latency gets ...
9
votes
3answers
2k views

Security tradeoffs of pathname-based MAC (e.g., TOMOYO, grsecurity, AppArmor, …)

I have been learning about MAC (Mandatory Access Control) systems in Linux. Often, but not always, these are tied to Linux Security Modules. Some systems I've looked at: SELinux, Tomoyo, AppArmor, ...
13
votes
2answers
613 views

How do I prevent my twin sister's “pulled from public record” information from being used when I try to answer security questions?

Several times in the past months, I have been asked security questions that are "pulled from public record" to verify my identity, either over the phone or on a website (Chase Bank, Walgreens ...
2
votes
1answer
324 views

what is the difference between virus, worm, trojan and other malware [closed]

Looking through the questions in IT security, I found out that there is no answer which cover this question in depth. I am aware of the answer and just hope to see something detailed about: main ...
4
votes
1answer
170 views

What physical, electronic, and software characteristics are important in a smart card?

I'm evaluating smart card readers to store a number of private keys, but don't know where to start. What criteria is important regarding smart cards and preventing the extraction or unauthorized used ...
2
votes
1answer
228 views

how does OpenSSL create X.509 certs from SPKACs?

The SPKAC ASN.1 description: PublicKeyAndChallenge ::= SEQUENCE { spki SubjectPublicKeyInfo, challenge IA5STRING } SignedPublicKeyAndChallenge ::= SEQUENCE { publicKeyAndChallenge ...
8
votes
3answers
997 views

How to authenticate a salted password?

If only the password hash is stored and the user inputs the original password, how does the program know that it is correct? I guess it could check all the possible salts but if there are 32bit salts ...
1
vote
1answer
417 views

spkac: what is the purpose of the challenge string?

The SPKAC ASN.1 description: PublicKeyAndChallenge ::= SEQUENCE { spki SubjectPublicKeyInfo, challenge IA5STRING } SignedPublicKeyAndChallenge ::= SEQUENCE { publicKeyAndChallenge ...
2
votes
3answers
3k views

KDC(Key Distribution Center) vs Asymmetric Key Exchange

Today I was reading notes about cryptography and I came across a problem that exists in Symmetric Key encryption, which is how to share the secret key across the network. 1st Method : Make use of ...
2
votes
4answers
1k views

Are malicious scripts in batch files detected by antiviruses?

we have many scripts in shared folders in our IT Department. Are malicious scripts in batch files detected by antiviruses?
0
votes
1answer
129 views

Manually monitoring your PC for Java (Oracle) exploits?

Sandboxing and AV's aside, if I wanted to manually look at/monitor my system for where they usually enter it, where could I look for possible malicious Java viruses/activity, e.g., would they first ...
0
votes
5answers
380 views

How to protect server uploads

I want to upload .jpg images to my Linux server so that clients can re-download the files when they want. Supposing unknowingly there is a trojan, worm or malware in my computer, will these be ...
6
votes
1answer
7k views

What is the fail2ban default setting for SSH login attempts?

I tried to block myself from my own server to test if fail2ban works correctly, so I tried ssh login and used a wrong password over and over. But I was blocked only after 13 failed logins instead of ...
13
votes
3answers
986 views

Do any DNS registrars support multi factor authentication?

I am looking for a DNS registrar that supports strong multi-factor authentication. Does any DNS registrar support multi-factor? Is this a legitimate need?
0
votes
0answers
77 views

Is it possible to attack system through torrent usage? [duplicate]

Possible Duplicate: What can do a hacker with ip address? I am using the Torrent for Downloading the Music and other files. I heard that using Torrent can give IPAddress information to ...
1
vote
3answers
286 views

How this kind of mechanism considered as vulnerability?

From following news, http://thehackernews.com/2012/12/etsy-for-iphone-loophole-allows.html Someone just setup a proxy to intercept traffic between browser and https protocol, then it called ...
4
votes
2answers
2k views

What did the certificate authority do with my CSR?

I needed to reach a web service which is not mine. The IT department of that web service has asked me to send them a CSR (certificate signing request). Then, he will send me back a signed certificate ...
4
votes
1answer
1k views

Where can a virus or other malware “hide” on common PC and Mac hardware?

I'm looking for a detailed list of locations that viruses can "hide" in modern hardware even after a reboot. Some things that come to mind include Boot BIOS/Firmware CPU Microcode Connected PCI ...
7
votes
1answer
920 views

Have any viruses leveraging the GPU been discovered in the wild? What is the mitigation?

This news article from 2010 discusses how a GPU can be used by a virus to avoid detection by common anti-malware/anti-virus software. The idea is to obfuscate the virus payload and leverage the GPU's ...
2
votes
1answer
240 views

Lamp server sandbox for testing malicious php script

Fortunately despite recently becoming a full time web developer, security is something I take very seriously. There's a developer that I work with who's system was recently compromised with obfuscated ...
4
votes
1answer
226 views

Key Management for PCI and Payment automation

We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : ...
2
votes
2answers
375 views

Password Manager - id_rsa as key file

I am finally taking the plunge and employing the use of a password manager. After some research I have selected KeePassX. My plan is to replace all my web passwords with random 16 character strings. ...
3
votes
1answer
76 views

Signing CertificateRequest with special privileges

Well, I am not sure if I specified the question correctly. While I was browsing web, I checked several SSL certificates and noticed that even Root Certificate doesn't have set all attributes of ...
5
votes
1answer
445 views

Using sudo to secure git deployment via web script

I'm setting up a server to do automatic deployment from a Bitbucket git repository, using Bitbucket's postback facility. Briefly, how it works it: I commit to Bitbucket Bitbucket POSTs to a ...
0
votes
1answer
80 views

Precedent for an in-house cardholder information server?

My organization is undertaking a project to attempt to reduce the amount of our infrastructure covered under PCI scope. Specifically, we're looking to exclude our web merchandising software from PCI ...
6
votes
2answers
908 views

Resource consumption attacks against algorithms

I am studying algorithm construction and weaknesses to resource consumption. One vulnerability that really caught my eye was the Apache Range Header DoS Vulnerability. The following quote was taken ...
2
votes
2answers
836 views

Physical Security for USB Keys and Systems-on-a-Stick

Do there exist physical security devices for USB sticks that serve a function analogous to laptop locks (i.e. preventing smash-and-grab type attacks)? If so, what are they and to what extent do they ...
3
votes
2answers
187 views

Proxying a Credit Card Transaction?

Lets say there is a service that processes a credit card, service X. I want to create a new service (Y) that has a form on it mirroring the fields from service X. I use the credentials entered into ...
9
votes
3answers
5k views

What issues arise from sharing a SSL certificate's private key?

Scenario: I am hosting a website for a my client, who we'll call S. S owns the domain s.com and I own the servers that actually host the website. S now wants to enable SSL on their website. I have ...
4
votes
3answers
9k views

BEAST: IIS6: Failing PCI scan - are these ciphers OK?

Our PCI compliance scanner, TrustWave, have failed our Win 2003/IIS6 site on BEAST because of the following cyphers: Cipher Suite: SSLv3 : DES-CBC3-SHA Cipher Suite: SSLv3 : RC4-SHA Cipher Suite: ...
2
votes
5answers
397 views

Is there value in storing passwords in their own table with encrypted or hashed keys?

The usual method for simple sites is to store a hash of a user's password right in their user record. What if the password field is removed from the user table, and a password table is created? The ...
2
votes
1answer
427 views

How should I audit and monitor shared TCP ports in Windows?

Windows has a feature called .NET TCP Port Sharing which allows different .NET applications to share the same TCP/IP port. I would like to monitor the source and destination connections of each ...
4
votes
2answers
260 views

Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?

I recently came across http://plaintextoffenders.com/ and I liked the idea. I wondered if there was a similar site that shames websites that force insecure passwords? I personally have a list of a ...
3
votes
2answers
134 views

Auditing Existing Socket Connection

Is there any way to interact with a program's socket traffic without installing Winpcap? I understand that the one listening program per port is a restriction regarding TCP/IP, but I guess I'm more ...
5
votes
2answers
289 views

Single vs multiple personas? What are the security implications?

I have two email addresses, one for work and one for home. I have have two cellphone numbers, one for work and one for home. But I am just one individual (and only have one social security number ...
1
vote
2answers
292 views

Is it possible to block third party cookies but allow them when they are first party?

I have been using Cookie Monster in Firefox for a while now to great satisfaction. However, I haven't found a way to allow cookies like Google's on Google's services but block them when I visit other ...
3
votes
2answers
1k views

What hardware technology (GPU, FPGA) is fastest at generating RSA keys?

I'm interested in generating RSA keys in rapid succession and am looking for the correct hardware to so. I think what I'm looking for is very similar to a brute force attack on RSA keys, but my ...
1
vote
4answers
1k views

openssl blowfish key limited to 256 bits?

I get the following error if I give a key that is greater than 64 hex caracters (64*4=256 bits). According to this official document, blowfish is able to support key from 32 to 448 bits. ...
4
votes
2answers
553 views

How secure are passwords that are set via IRC's /nicksrv?

I just registered a nickname on IRC and had to use a password to register it. Given that I've only used IRC, but never understood the P2P mechanics of it, I'd like to know: Is the password I ...
1
vote
2answers
249 views

Authentication without saving password

Are there any security problems with following authentication protocol? when user creates hers account, she provides her username and password. I store the username and blowfishEncrypt(toEncrypt = ...
165
votes
8answers
74k views

Why not use larger cipher keys?

RSA Security commonly uses keys of sizes 1024-bit, 2048-bit or even 3072-bit. And most Symmetric algorithms only between 112-bit and 256-bit. I do realize that the current keys are secure enough for ...
22
votes
7answers
7k views

Why don't people hash and salt usernames before storing them

Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext. What I ...
1
vote
4answers
18k views

Brute-force an SSH-login that has only a 4-letter password

Suppose, you know that a certain computer is only protected by such a short password, then you could just try every possible combination easily. How would a script look like, that tries to crack that ...
0
votes
3answers
152 views

Does including decorative HTTP headers into server reply pose extra security risk?

Suppose I reconfigure my HTTP server to add the following HTTP header into every reply: X-Hello: Hello! or some other presumably funny text. Can this have any negative effect on the server ...
7
votes
1answer
1k views

What is the difference between Simple Power Analysis and Differential Power Analysis?

What is the difference between Simple Power Analysis (SPA) and Differential Power Analysis (DPA) and why is it not possible to do an SPA attack on FPGAs? My basic understanding is they are ...
6
votes
3answers
345 views

Are there guidelines for application design of HIPAA compliant browser applications?

This is a different twist - I'm pushing dispatch information to first responders, such as fire, police, and EMS. But they all could, potentially, include medical information and PII together. My goal ...
1
vote
2answers
3k views

Is it possible to decrypt symmetric key encryption without the key?

I have an document encrypted with a symmetric key. The only information I have is that the key is shorter than 64 bits. Is there any way I can decrypt it? If yes, how?
5
votes
3answers
165 views

Disclosure in potential loss-of-life situations, with an uncooperative vendor

I recently discovered a publicly accessible web interface to a highly sensitive bit of lab equipment, the malfunction of which would result in potential loss of life or serious health concerns to a ...
3
votes
5answers
2k views

Is there an asymmetric encryption algorithm that maintains the length of the plaintext?

I want to protect some registers by encrypting them without providing additional memory space. Is there a encryption algorithm that will maintain the length of the data to be encrypted? (i.e. ...
3
votes
4answers
486 views

Safari downloaded my php source once. Should I worry?

I uploaded via ftp, then typed in the URL of the script to Safari; Safari downloaded the source!! This hosting site has never done that before - .php scripts have always executed. I can't duplicate ...

15 30 50 per page